Our Privacy Policy

1. Who we are (data controller).

2. Personal data we collect.

• Account data: your name, email address, phone number (if you provide it), your password (stored only in hashed form, never in plain text), your language and currency preferences, and your marketing-email preference.
• Checkout and order data: first and last name, email address, phone number, billing address, the package you buy, order number, price, currency, any SimSwift points used, and order dates.
• eSIM data: the eSIM identifiers and activation details (such as the ICCID and QR code) and the status, validity and data usage of your eSIM, which we receive from our eSIM provisioning partner.
• Payment data: the payment method you chose, the payment status and the transaction reference returned by the payment provider. We do not store full card numbers or card security codes (CVV) – see section 5.
• Consent records: your confirmations at checkout that you accept our terms, that you are at least 18 years old, and that you request immediate delivery of the eSIM and acknowledge that you lose your right of withdrawal once the eSIM is activated, together with the time, your IP address and your browser’s user agent.
• Technical and security data: IP address, approximate country derived from your IP address (used to show prices in your local currency), browser and device type, and server and security logs that we use to protect the website against fraud, abuse and automated attacks.
• Communications: messages you send us through the contact form or by email, and our replies.
• Newsletter: your email address, if you subscribe to our newsletter.
• Partner referral data: if you arrive through a partner’s referral link, the link identifier and the time, IP address and browser of the click.
• Analytics data (only with your consent): information about how you use our website (pages visited, device and browser type, approximate location and interactions), collected through Google Analytics 4.

3. Where we get your data.

• From you, when you create an account, place an order, contact us or subscribe to our newsletter.
• Automatically from your device, when you use our website (see our Cookie Policy).
• From our payment service providers (payment status and transaction reference) and from our eSIM provisioning partner (eSIM status and usage).

4. Why we use your data and our legal bases.

• To create and manage your account – performance of a contract (Article 6(1)(b) GDPR).
• To process your order and payment, deliver and support your eSIM, and send you order confirmations, receipts, invoices and service messages – performance of a contract (Article 6(1)(b) GDPR).
• To answer your questions and complaints and to handle refund and withdrawal requests – performance of a contract and our obligations under consumer law (Article 6(1)(b) and (c) GDPR).
• To keep accounting records and invoices and to comply with tax, consumer-protection and other legal obligations, including requests from competent authorities – legal obligation (Article 6(1)(c) GDPR).
• To record the confirmations you give at checkout, so that we can prove them – legal obligation and our legitimate interest in establishing and defending legal claims (Article 6(1)(c) and (f) GDPR).
• To prevent fraud and payment abuse, to authenticate card payments (3-D Secure) and to keep our website and systems secure – our legitimate interest in protecting our customers and our business (Article 6(1)(f) GDPR) and, where applicable, legal obligation.
• To credit partners for purchases made through their referral links – our legitimate interest in running our partner programme (Article 6(1)(f) GDPR).
• To show prices in your local currency based on your approximate location – our legitimate interest in offering a relevant website (Article 6(1)(f) GDPR).
• To send you our newsletter and marketing emails – your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email or on your Profile page.
• To measure how our website is used with Google Analytics – your consent (Article 6(1)(a) GDPR). You can withdraw it at any time in Cookie settings.
• To establish, exercise or defend legal claims – our legitimate interest (Article 6(1)(f) GDPR).

5. Payments and card data.

6. Who we share your data with.

• Payment service providers: FlowaPay, Paytech (and the banks it works with, DSK Bank and PostBank) and PayPal – to process payments, 3-D Secure authentication, refunds and chargebacks.
• Our eSIM provisioning partner, Yesim – receives the order data needed to issue and manage your eSIM.
• Our email delivery (SMTP) provider – to send order confirmations, receipts, invoices, service messages and, if you agreed, newsletters.
• Hosting and infrastructure providers – to host our website, servers and databases.
• Google (Google Analytics 4) – only if you consent to analytics cookies.
• Partner brands and resellers – only if you bought through their referral link or partner page: they can see the order number, package, amount and date, and your name and email address, for referral attribution and commission calculation. They never receive your payment details.
• Professional advisers (such as accountants, auditors and lawyers), who are bound by confidentiality.
• Public authorities, courts and regulators (for example the National Revenue Agency, the Commission for Consumer Protection, the Commission for Personal Data Protection or law-enforcement authorities) – only when we are legally required to do so, or to establish, exercise or defend legal claims.
• A buyer or successor, if our business or assets are sold or restructured, subject to this Policy.

7. International transfers.

8. How long we keep your data.

• Orders, invoices, payment records and the related checkout confirmations: up to 10 years, as required by the Bulgarian Accountancy Act and tax law.
• Account data: for as long as your account is open. When you close your account, we delete or anonymise your account data, except data we must keep by law (such as invoices and order records).
• Newsletter and marketing data: until you unsubscribe or withdraw your consent.
• Contact-form and support messages: for as long as needed to handle your request and for up to 3 years afterwards, in case of follow-up questions or legal claims.
• Security logs: for a limited period, normally no longer than 12 months, unless needed to investigate an incident.
• Partner referral data: for as long as needed to calculate and pay partner commissions and, where linked to an order, as part of the order records above.
• Cookies and analytics data: as listed in the table in section 10 and in our Cookie Policy.

9. Your rights.

• access your personal data and receive a copy of it;
• have inaccurate data corrected (rectification);
• have your data erased, where there is no longer a legal reason to keep it;
• restrict the processing of your data in certain cases;
• receive the data you gave us in a structured, machine-readable format and have it transmitted to another controller (portability);
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• withdraw any consent you have given at any time, without affecting the lawfulness of processing before the withdrawal.

10. Cookies.

11. Security.

12. Age.

13. Changes to this Policy.